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REMARKS 

The following remarks are made in response to the Final Office Action mailed July 2, 
2004. Claims 1-31 were rejected. Claims 1-31 remain pending in the application and are 
presented for reconsideration and allowance. 

Claim Rejections u nder 35 II-S.C. 5 103 

Claims 1-31 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. Patent 
No. 6,405,25 1 by Bullard et al. ("Bullard") in view of U.S. Patent No. 5.970,490 by Morgenstem 
("Morgenstem"). Applicant submits that the Bollard reference alone or in combination with the 
Morgenstem reference fails to disclose, teach, or suggest the invention of independent claims 1, 
13, 17, 24, 26 and 30. 

Independent claim 1 recites a method for recording network usage. The method 
comprises defining a network data collector including an encapsulate^ ah aggregator, and a data 
storage system. A set of network accounting data is received via the encapsulates A network 
accounting data set is converted to a standard data format. The network accounting data set is 
processed via the aggregator, including defining a rule chain and applying the rule chain to the 
network accounting data set to construct an aggregation tree including creating an aggregated 
network accounting data set. The aggregated network accounting data set is stored in the data 
storage system. 

Bullard discloses a system for enhancement of network accounting records. The system 
includes a data collector layer 18 that is a distributed layer of individual data collectors. The data 
collectors collect raw accounting information and convert data into normalized records referred 
to as network accounting records (NARs). Each of the data collectors forwards network 
accounting records to a flow aggregation process 60. (See column 3, lines 43-54). The flow 
aggregation process 60, including aggregation processor 13, is a central collection point for all 
network accounting records produced from various data collectors in the data collection layer 18. 
The flow aggregation processor 60 aggregates and/or enhances record data across the network 
devices to produce summary NARs' (column 4, lines 1-26), and (column 18, lines 39^9). The 
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data can be further enhanced and/or reduced (i.e., aggregated) to meet the specific needs of an 
application or output interface based on the aggregation policy of the flow data processor 60. 

Morgenstern discloses an integration system for processing heterogeneous data from 
multiple sources. The integration system utilizes an interoperability assistant module 20 (figure 
2) including specifications for transforming the heterogeneous data into a common intermediate 
representation of the heterogeneous data using the specifications and creating an information 
bridge with the interoperability assistant module through a process of program generation. (See 
col. 1 7 lines 10-17). The system provides high-level user interfaces and program level access 
across heterogeneous databases, allowing immigration of a variety of information resources 
including relational and object databases, CAD design tools, simulation packages, data analysis 
and visualization tools, and other software modules. (Col. 3, lines 7-13). 

High level transformation rule specifications (HLTRS) are utilized by the system to 
transform data from a source data representation to a target data representation. (See coJ. 8, lines 
5-8). The HLTRS are sent to a transformer generator 42, which generates code files that 
describe the transformation rules in a form usable by a dependency graph 200 (see figure 4), 
which controls the data flow from source to target. (Col. 8, lines 53-57). Dependency graph 200 
is the basis for rule execution. Dependency graph 200 is composed of an input tree 21 0, a rule 
graph 220, and an output tree 230. (See fig. 4 and col. 20, lines 46-50). Input data instances are 
first inserted into the input tree. The data instances are then passed by the input tree to the rule 
graph, together with completion signals. The rule graph 220 will apply specified transformation 
rules on the data instances to generate intermediate instances and output instances. The final 
rules of the rule graph insert the output instances into the output tree 230, which assembles and 
eventually outputs them accordingly. (Col. 21, lines 19-23). 

The examiner conceded that Bullard does not teach processing the network accounting 
data set via the aggregator, including the steps of defining a rule chain and applying the 
rule chain to the network accounting data set to construct an aggregation tree including 
creating an aggregated network accounting data set. (Office Action, pg. 3 and pg. 4; See 
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also pg. 2 Response to Arguments, paragraph 1). The examiner submits that this limitation is 
taught by Morgenstern. 

Morgenstern does not disclose defining a rule chain and applying the rule chain to the 
network accounting data to construct an aggregation tree including creating an aggregated 
network accounting data set as claimed by Applicant. Morgenstern merely discloses a rule 
graph 220 and the input tree 210 and output tree 230. The rule graph 220 is a directed graph and 
consists of data nodes and rule nodes. Each rule node is connected to one or more input data 
nodes and no more than one output data node. (See col. 21, lines 41-44). Rule graph 220 is not 
a rule chain as claimed by Applicant. In Morgenstern, input data instances are first inserted 
into the input tree. The data instances are then passed by the input tree to the rule graph, 
together with completion signals. The rule graph 220 will apply specified transformation rules 
on the data instances to generate intermediate instances and output instances. The final rules of 
the rule graph insert the output instances into the output tree 230 which assembles and eventually 
outputs them accordingly. (See Morgenstern, Col. 21, lines 19-26). [Emphasis Added]. 

In contrast, Applicant applies a rule chain to the network accounting data set to 
construct an aggregation tree including an aggregated network accounting data set. In 
view of the above* one skilled in the art could not combine the teachings of Bullard in view of 
Morgenstern and arrive at the present invention of independent claim 1. 

Further, Bullard and Morgenstern fail to teach or suggest such a combination. Again, 
Bullard fails to teach or suggest defining a rule chain and applying the rule chain to the network 
accounting data set to construct an aggregation tree. 

Morgenstern is directed to a method for processing heterogeneous data and does not 
disclose or even relate to collecting network accounting data. Rather, Morgenstern is direct to 
heterogeneous databases for design, engineering and manufacturing applications (e.g., computer 
aided design). 

In view of the above, Applicants respectfully submit that the above rejection of 
independent claim 1 under 35 U.S.C. 103(a) should be withdrawn. 
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Dependent claims 2-12 depend directly or indirectly upon independent claim 1 . 
Accordingly, dependent claims 2-12 are also allowable over the art of record. 

Bullard, either alone or in combination with Morgenstern, also does not teach or suggest 
the claim recitations in independent claim 13. Claim 13 recites a method for recording network 
usage including correlating of network usage information and network session information. The 
method includes defining a network data correlator collector including an encapsulator, an 
aggregator, and a data storage system. A set of network session data is received via the 
encapsulator. The network session data set is processed via the aggregator, including the steps of 
defining a first rule chain and applying the first rule chain to the network session data to 
construct an aggregation tree. A set of network usage data is received via the encapsulator. The 
network usage data set is processed via the aggregator, including the steps of defining a second 
rule chain and applying the second rule chain to the network usage data and the aggregation tree 
to construct a correlated aggregation tree. A correlated data set is determined from the correlated 
aggregation tree. The correlated data set is stored in the data storage system. Bullard and 
Morgenstern do not teach or suggest these claim recitations. 

As discussed above, Bullard fails to disclose processing a network session data set via 
the aggregator, including the steps of defining a first rale chain and applying the first role 
chain to the network session data to construct an aggregation tree, and processing a 
network usage data set via the aggregator, including the steps of defining a second rule 
chain and applying the second rule chain to the network usage data and the aggregation 
tree to construct a correlated aggregation tree. 

Morgenstern al so does not disclose defining a first rule chain and applying the first 
rale chain to the network session data to construct an aggregation tree and defining a 
second rule chain and applying the second rule chain to the network usage data and the 
aggregation tree to construct a correlated aggregation tree as claimed by Applicant. In view 
of the above, one skilled in the art could not combine the teachings of Bullard in view of 
Morgenstern and arrive at the present invention of independent claim 13. Accordingly, 
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Applicant respectfully submits that the above rejection of independent claim 13 under 35 U.S.C. 
103(a) should be withdrawn. 

Dependent claims 14-16 depend direcdy or indirectly upon independent claim 13. 
Accordingly, dependent claims 14-16 are also allowable over the art of record. 

Bullard, either alone or in combination with Morgenstem, also does not teach or suggest 
the claim recitations in independent claim 17. Claim 17 recites a method for recording network 
usage. The method includes defining a first network data collector including a first encapsulate, 
a first aggregator, and a first data storage system. A first set of network data is received via the 
first encapsulates The first network data set is processed via the first aggregator, including the 
steps of defining an aggregation rule chain in determining a first set of aggregated data by 
applying the aggregation rule chain to the first set of network data. The first aggregated network 
data set is stored in the first data storage system. Bullard and Morgenstem do not teach or 
suggest these claim recitations. Applicant respectfully submits that the above rejection of 
independent claim 17 under 35 U.S.C. 103(a) should be withdrawn. 

Dependent claims 18-23 depend directly or indirectly upon independent claim 17. 
Accordingly, these dependent claims are allowable over the art of record. 

Bullard, either alone or in combination with Morgenstem, also does not teach or suggest 
the claim recitations in independent claim 24. Claim 24 recites a network usage recording . 
system having a network data collector. The network data collector includes an encapsulate for 
receiving a set of network accounting data and converting the network accounting data set to a 
standard data format. An aggregator processes the network accounting data set, the aggregator 
including a defined rule chain, wherein the aggregator applies the rule chain to the network 
accounting data set to construct an aggregation tree, and determines a set of aggregated network 
accounting data from th e aggregation tree. A data storage system stores the aggregated network 
accounting data, Bullard and Morgenstem do not teach or suggest these claim recitations. 
Applicant respectfully submits that the above rejection of independent claim 24 under 35 U.S.C. 
103(a) should be withdrawn. 
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Dependent claim 25 depends directly upon independent claim 24. Accordingly, this 
dependent claim is allowable over the art of record. 

BuJlard, either alone or in combination with Morgenstern, also does not teach or suggest 
the claim recitations in independent claim 26. Claim 26 recites a network usage recording 
system having a network data correlator collector. The network data correlator collector includes 
an encapsulator which receives a set of network session data. An aggregator for processing the 
network session data set, the aggregator including a defined first rule chain wherein the 
aggregator applies the first rule chain to the network session data set to construct an aggregation 
tree. The encapsulator receives a set of network usage data, and the aggregator processes the 
network usage data set, the aggregator including a defined second rule chain, wherein the 
aggregator applies the second rule chain to die network usage data set and the aggregation tree to 
construct a correlated aggregation tree, and determines a correlated data set from the correlated 
aggregation tree. A data storage system stores the correlated data set. Bullard and Morgenstern 
do not teach or suggest these claim recitations. Applicant respectfully submits that the above 
rejection of independent claim 26 under 35 U,S.C. 103(a) should be withdrawn. 

Dependent claims 27-29 depend either directly or indirectly upon independent claim 26. 
Accordingly, these dependent claims are allowable over the art of record. 

Bullard, either alone or in combination with Morgenstern, also does not teach or suggest 
the claim recitations in independent claim 30. Claim 30 recites defining a first network data 
collector including a first encapsulator, a first aggregator, and a first data storage system. A first 
set of network data is received via the first encapsulator. The first network data set is processed 
via the first aggregator, including defining an aggregation rule chain and determining a first set 
of aggregated data by applying the aggregation rule chain to the first set of network data. The 
first aggregated network data set is stored in the first data storage system. 

Applying the aggregation rule chain to the first set of network data further comprises 
constructing an aggregation tree. The first aggregated network data set is determined from the 
aggregation tree, where constructing an aggregation tree includes defining the first network data 
set to include a first network data event and a second network data event. The aggregation rule 
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chain is applied to the first network data event to construct a hierarchy of group nodes within the 
aggregation tree. The aggregation rule chain is applied to the second network data event to 
locate similar group nodes according to a predefined set of match rules, if no matching group 
nodes exist, the hierarchy of group nodes is extended within the aggregation tree by creating 
additional group nodes. 

Applying the aggregation rule chain to the first network data event further includes 
defining the aggregation rule chain to include a first match rule for matching source IP address. 
The first network data event is defined to include a first source IP address. The first match rule 
is applied to the first network data event, including determjrring whether the aggregation tree 
includes a first group node matching the first source IP address, and if a matching first group 
node does not exist, creating the first group node for the first source IP address. 

Applying the aggregation rule chain to the first network data event includes defining the 
aggregation ride chain to include a second match rule for matching destination IP address. The 
first network data event is defined to include a first destination IP address. The second match 
rule is applied to the first network data event, including determining whether the aggregation tree 
includes a second group node matching the first destination IP address, and if a matching second 
group node does not exist, creating the second group node for the first destination IP address. 
Applying the aggregation rule chain to the first network data event further includes defining the 
aggregation rule set to include an aggregation rule- The first network data event is defined to 
include a port number and volume of information. The aggregation rule is applied to the first 
network data event, including copying the port number, source IP address, destination IP address 
and volume information to the second group node. Bullard and Morgenstem do not teach or 
suggest these claim recitations. Applicant respectfully submits that the above rejection of 
independent claim 30 under 35 U.S.C, 103(a) should be withdrawn. 

Dependent claim 31 depends directly upon independent claim 30. Accordingly, this 
dependent claim is allowable over the art of record. 
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CONCLUSION 

In view of the above, Applicant respectfully submits that pending claims 1-31 are in form 
for allowance and are not taught or suggested by the cited references. Therefore, reconsideration 
and withdrawal of the rejections and allowance of claims 1-31 is respectfully requested. 

No fees are required under 37 C.F.R. U6(b)(c). However, if such fees are required, the 
Patent Office is hereby authorized to charge Deposit Account No. 50-0471. 

The Examiner is invited to contact the Applicant's representative at the below-listed 
telephone numbers to facilitate prosecution of this application. 
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Any inquiry regarding this Response should be directed to either Phi? Lyren at Telephone 
No. (281) 514-8236, Facsimile No. (281) 514-8332 or Steven E. Dicke at Telephone No. (612) 
573-2005, Facsimile No. (612) 573-2005. In addition, all correspondence should continue to be 
directed to the following address: 

Hewlett-Packard Company 

Intellectual Property Administration 
P.O. Box 272400 

Fort Collins, Colorado 80527-2400 

Respectfully submitted, 

Alexander C. Ranous et al., 

By their attorneys, 

DICKE, BILLIG & CZAJA, PLLC 
Fifth Street Towers, Suite 2250 
100 South Fifth Street 
Minneapolis, MN 55402 
Telephone: (612) 573-2002 
Facsimile: (612) 573^2005 ^ 



Date: A y>W 2jT } 7,^*/ Vff>^ £ ) 

SED:jan Q Steven E. Dicke c 



Iteven E. Dicke 
Reg. No. 38,431 




CERTTFrCATF r UNDER ft 7 O.F.'R 18 : The undersigned hereby certifies that this paper or papers, as described 
herein, ai^emg facsimile cransmitted to the United States Parent and Trademark Office, Fax Mo. (703) 872-9306 
on this day of August, 2004. S v. J - } 

Name: Steven E. Dicke _ 
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